Daniel B. Thurman wrote:
>Sent: Sunday, December 09, 2007 8:54 PM
>To: Fedora-List (E-mail)
>Subject: [F8] Sendmail, SpamAssasin, ClamAV and SELinux
>
>
>
>SELinux is preventing Sendmail from accessing spamass-milter.sock
>and clamav-milter.sock in their respective /var/run subdirectories.
>
>The /var/run/{clamav-milter,spamass-milter} attributes are:
>
>/var/run/clamav-milter var_run_t
>/var/run/clamav-milter/clamav-milter.sock: var_run_t
>
>/var/run/spamass-milter var_run_t
>/var/run/spamass-milter/spamass-milter.sock: spamd_var_run
>
>The MAIN problem is that even though it is NOT a problem starting
>the spamassasin and clamav programs but the sendmail program
>fails to start up because sendmail is denied permissions to access
>the clamav and spamass milter directory/file in /var/run areas.
>
>The sendmail.mc(cf) file has input-filters installed in them so that is
>why sendmail wants to use the clamav and spamassasin filters but
>is prevented from doing so due to selinux access permission denials.
>
>Sendmail has sendmail_t selinux tags but how is it allowed to access
>either of the above sock files if no selinux tags are assigned
>to neither?
>
>Please advise.
>
>Thanks!
>Dan
>
>--
Here are the SELinux reports for more details. I have disabled
clamav and spamassassin from the sendmail.mc file for now.
==========================================================
Summary
SELinux is preventing /usr/sbin/sendmail.sendmail (sendmail_t) "getattr" to
/var/run/clamav-milter/clamav.sock (var_run_t).
Detailed Description
SELinux denied access requested by /usr/sbin/sendmail.sendmail. It is not
expected that this access is required by /usr/sbin/sendmail.sendmail and
this access may signal an intrusion attempt. It is also possible that the
specific version or configuration of the application is causing it to
require additional access.
Allowing Access
Sometimes labeling problems can cause SELinux denials. You could try to
restore the default system file context for /var/run/clamav-
milter/clamav.sock, restorecon -v /var/run/clamav-milter/clamav.sock If this
does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see
http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable
SELinux protection altogether. Disabling SELinux protection is not
recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi
against this package.
Additional Information
Source Context system_u:system_r:sendmail_t:s0
Target Context system_u:object_r:var_run_t:s0
Target Objects /var/run/clamav-milter/clamav.sock [ sock_file ]
Affected RPM Packages sendmail-8.14.2-1.fc8 [application]clamav-
milter-0.91.2-3.fc8 [target]
Policy RPM selinux-policy-3.0.8-62.fc8
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name plugins.catchall_file
Host Name linux.cdkkt.com
Platform Linux linux.cdkkt.com 2.6.23.8-63.fc8 #1 SMP Wed
Nov 21 18:51:08 EST 2007 i686 i686
Alert Count 3
First Seen Mon 10 Dec 2007 11:02:42 AM PST
Last Seen Mon 10 Dec 2007 11:28:29 AM PST
Local ID f06fe44d-c540-45eb-b792-2949a7404482
Line Numbers
Raw Audit Messages
avc: denied { getattr } for comm=sendmail dev=sda2 egid=51 euid=0
exe=/usr/sbin/sendmail.sendmail exit=-13 fsgid=51 fsuid=0 gid=0 items=0
path=/var/run/clamav-milter/clamav.sock pid=7622
scontext=system_u:system_r:sendmail_t:s0 sgid=51
subj=system_u:system_r:sendmail_t:s0 suid=0 tclass=sock_file
tcontext=system_u:object_r:var_run_t:s0 tty=pts7 uid=0
Summary
SELinux is preventing spamassassin (procmail_t) "write" to <Unknown>
(clamd_var_lib_t).
Detailed Description
SELinux denied access requested by spamassassin. It is not expected that
this access is required by spamassassin and this access may signal an
intrusion attempt. It is also possible that the specific version or
configuration of the application is causing it to require additional access.
Allowing Access
Sometimes labeling problems can cause SELinux denials. You could try to
restore the default system file context for <Unknown>, restorecon -v
<Unknown> If this does not work, there is currently no automatic way to
allow this access. Instead, you can generate a local policy module to allow
this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385
Or you can disable SELinux protection altogether. Disabling SELinux
protection is not recommended. Please file a
http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
Additional Information
Source Context system_u:system_r:procmail_t:s0
Target Context system_u:object_r:clamd_var_lib_t:s0
Target Objects None [ dir ]
Affected RPM Packages
Policy RPM selinux-policy-3.0.8-62.fc8
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name plugins.catchall_file
Host Name linux.cdkkt.com
Platform Linux linux.cdkkt.com 2.6.23.8-63.fc8 #1 SMP Wed
Nov 21 18:51:08 EST 2007 i686 i686
Alert Count 9
First Seen Mon 10 Dec 2007 10:22:35 AM PST
Last Seen Mon 10 Dec 2007 11:21:37 AM PST
Local ID 0dec68d7-43d0-4140-b747-1fb2300de7ed
Line Numbers
Raw Audit Messages
avc: denied { write } for comm=spamassassin dev=sda2 egid=491 euid=496
exe=/usr/bin/perl exit=-13 fsgid=491 fsuid=496 gid=491 items=0 name=clamav
pid=7447 scontext=system_u:system_r:procmail_t:s0 sgid=491
subj=system_u:system_r:procmail_t:s0 suid=496 tclass=dir
tcontext=system_u:object_r:clamd_var_lib_t:s0 tty=(none) uid=496
Summary
SELinux is preventing /usr/sbin/sendmail.sendmail (sendmail_t) "search" to
<Unknown> (spamd_var_run_t).
Detailed Description
SELinux denied access requested by /usr/sbin/sendmail.sendmail. It is not
expected that this access is required by /usr/sbin/sendmail.sendmail and
this access may signal an intrusion attempt. It is also possible that the
specific version or configuration of the application is causing it to
require additional access.
Allowing Access
Sometimes labeling problems can cause SELinux denials. You could try to
restore the default system file context for <Unknown>, restorecon -v
<Unknown> If this does not work, there is currently no automatic way to
allow this access. Instead, you can generate a local policy module to allow
this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385
Or you can disable SELinux protection altogether. Disabling SELinux
protection is not recommended. Please file a
http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.
Additional Information
Source Context system_u:system_r:sendmail_t:s0
Target Context system_u:object_r:spamd_var_run_t:s0
Target Objects None [ dir ]
Affected RPM Packages sendmail-8.14.2-1.fc8 [application]
Policy RPM selinux-policy-3.0.8-62.fc8
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name plugins.catchall_file
Host Name linux.cdkkt.com
Platform Linux linux.cdkkt.com 2.6.23.8-63.fc8 #1 SMP Wed
Nov 21 18:51:08 EST 2007 i686 i686
Alert Count 3
First Seen Mon 10 Dec 2007 11:02:42 AM PST
Last Seen Mon 10 Dec 2007 11:03:30 AM PST
Local ID 2c99868b-1707-4ecf-b3b8-ea0f4f092b3b
Line Numbers
Raw Audit Messages
avc: denied { search } for comm=sendmail dev=sda2 egid=51 euid=0
exe=/usr/sbin/sendmail.sendmail exit=-13 fsgid=51 fsuid=0 gid=0 items=0 name
=spamass-milter pid=7147 scontext=system_u:system_r:sendmail_t:s0 sgid=51
subj=system_u:system_r:sendmail_t:s0 suid=0 tclass=dir
tcontext=system_u:object_r:spamd_var_run_t:s0 tty=pts7 uid=0
Summary
SELinux is preventing /usr/sbin/sendmail.sendmail (sendmail_t) "getattr" to
/var/run/spamass-milter (spamd_var_run_t).
Detailed Description
SELinux denied access requested by /usr/sbin/sendmail.sendmail. It is not
expected that this access is required by /usr/sbin/sendmail.sendmail and
this access may signal an intrusion attempt. It is also possible that the
specific version or configuration of the application is causing it to
require additional access.
Allowing Access
Sometimes labeling problems can cause SELinux denials. You could try to
restore the default system file context for /var/run/spamass-milter,
restorecon -v /var/run/spamass-milter If this does not work, there is
currently no automatic way to allow this access. Instead, you can generate
a local policy module to allow this access - see
http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable
SELinux protection altogether. Disabling SELinux protection is not
recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi
against this package.
Additional Information
Source Context system_u:system_r:sendmail_t:s0
Target Context system_u:object_r:spamd_var_run_t:s0
Target Objects /var/run/spamass-milter [ dir ]
Affected RPM Packages sendmail-8.14.2-1.fc8 [application]spamass-
milter-0.3.1-5.fc8 [target]
Policy RPM selinux-policy-3.0.8-62.fc8
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name plugins.catchall_file
Host Name linux.cdkkt.com
Platform Linux linux.cdkkt.com 2.6.23.8-63.fc8 #1 SMP Wed
Nov 21 18:51:08 EST 2007 i686 i686
Alert Count 3
First Seen Mon 10 Dec 2007 11:02:42 AM PST
Last Seen Mon 10 Dec 2007 11:03:30 AM PST
Local ID 55aa49d1-3ea7-4e6a-80a6-087c37eaf2ba
Line Numbers
Raw Audit Messages
avc: denied { getattr } for comm=sendmail dev=sda2 egid=51 euid=0
exe=/usr/sbin/sendmail.sendmail exit=-13 fsgid=51 fsuid=0 gid=0 items=0
path=/var/run/spamass-milter pid=7147 scontext=system_u:system_r:sendmail_t:s0
sgid=51 subj=system_u:system_r:sendmail_t:s0 suid=0 tclass=dir
tcontext=system_u:object_r:spamd_var_run_t:s0 tty=pts7 uid=0
===============================================================================
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.5.503 / Virus Database: 269.16.17/1179 - Release Date: 12/9/2007 11:06 AM
